Siderophile: Expose your Crate’s Unsafety

Summary: Trail of Bits released siderophile, a tool that trawls a Rust crate's dependencies to find every unsafe function, expression, and trait method, then traces them up the callgraph to the function in the crate that uses the unsafety and ranks those functions by a "badness" rating. The tool was built for an engagement on a large Rust codebase with a tight review timeframe, and the authors note it cannot inspect macros or resolve dynamically dispatched methods because unsafe tagging only occurs at source level.
Bottom line: The tool exists because a team handed a massive Rust codebase could not tell where to start fuzzing - and its blind spots, macros and dynamically dispatched methods, are exactly where unsafe code can hide from a source-level scan.

Read the original at Trail of Bits Blog ↗